安全安装
- 作者仓库星标 175
- 作者更新于 实时读取
- 作者仓库 pai-opencode
- 领域
- 安全
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @Steffen025 · 未声明 license
- Token 消耗评级
- 中等消耗
- 接入复杂程度
- 需简单配置
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- macOS · Linux
- 底层运行要求
- 无特殊要求
- 文件与系统权限
-
- 只读
- Shell 执行
- 允许写入 / 修改
- 网络行为
- 仅限本地
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: CodeReview
description: AI-powered code review via roborev. USE WHEN review code, check code quality, roborev, audit cha…
category: 安全
runtime: 无特殊运行时
---
# CodeReview 输出预览
## PART A: 任务判断
- 适用问题:安全审计、密钥扫描、权限检查或风险分析。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“USE WHEN / MANDATORY / OPTIONAL”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于安全审计、密钥扫描、权限检查或风险分析,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“USE WHEN / MANDATORY / OPTIONAL”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、执行终端命令、写入/修改文件、主要在本地完成、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、执行终端命令、写入/修改文件;主要在本地完成;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文没有稳定的斜杠命令要求。安装验证后通常全局生效,直接在对话里点名这个 Skill 并描述任务即可。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、执行终端命令、写入/修改文件。
先用一个小任务确认它会围绕“USE WHEN / MANDATORY / OPTIONAL”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: CodeReview
description: AI-powered code review via roborev. USE WHEN review code, check code quality, roborev, audit cha…
category: 安全
source: Steffen025/pai-opencode
---
# CodeReview
## 什么时候使用
- CodeReview 是安全方向的技能,由 Agent 做扫描 / 风险检查 适合处理安全审计、密钥扫描、权限检查和风险分析,核心价值是把输入、判断、执行、验证和交付边界固定下来,避免 Agent 泛泛回答。 把任务拆成可执行、可检查…
- 面向安全审计、密钥扫描、权限检查或风险分析,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「USE WHEN / MANDATORY / OPTIONAL」组织步骤,不把推断写成作者事实。
- 读取文件、执行终端命令、写入/修改文件;主要在本地完成;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "CodeReview" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> USE WHEN / MANDATORY / OPTIONAL
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> 无特殊运行时 | 读取文件、执行终端命令、写入/修改文件 | 主要在本地完成
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} CodeReview Skill
Use this skill to run AI-powered code review via roborev — a local, MIT-licensed review tool with explicit OpenCode support.
USE WHEN
- Completing a BUILD phase and want to catch issues before committing
- Running VERIFY phase and need reproducible quality evidence
- Reviewing a PR diff before merging
- Auditing plugin handler code for pattern violations (no
console.log, handler structure) - You want AI-powered architectural review of your changes
- Trigger phrases: "review code", "check my changes", "roborev", "code quality check"
MANDATORY
- roborev must be installed —
brew install roborev-dev/tap/roborev - One-time init —
roborev init(installs post-commit git hook) .roborev.tomlmust exist at repo root withagent = "opencode"andreview_guidelines- Invoke via
code_reviewtool (preferred) orroborev review --dirtyin EXECUTE phase - Cite exit code 0 as VERIFY evidence:
code_review tool returned exit 0 — no findings
OPTIONAL
roborev skills install— installs the roborev OpenCode skill (adds roborev commands to agent)mode: "last-commit"— review the last git commit instead of dirty working treemode: "fix"— feed findings to the agent for automatic fixesmode: "refine"— run auto-fix loop until review passespathargument — focus review on a specific file or glob
What roborev Does
roborev analyzes your staged/uncommitted changes (or last commit) using an LLM and surfaces:
- Code quality issues
- Security concerns
- Architectural violations
- Style inconsistencies
- Bugs and edge cases
All review runs locally. No account or cloud service required.
Quick Reference
# Review uncommitted changes (most common)
roborev review --dirty
# Review last commit
roborev review
# Feed findings to agent for fixes
roborev fix
# Auto-fix loop until review passes
roborev refine
# Install git post-commit hook (one-time)
roborev init
# Install OpenCode skill for roborev
roborev skills install
Algorithm Integration
When to invoke
The Algorithm invokes code review in two ways:
1. Via code_review tool (plugin-provided)
Call the code_review tool directly from any Algorithm phase:
Use code_review tool with mode="dirty" to review uncommitted changes before commit.
2. Via roborev CLI in EXECUTE/VERIFY phase
# In EXECUTE: review before committing
roborev review --dirty
# In VERIFY: evidence that review passed
roborev review --dirty && echo "PASS" || echo "FINDINGS"
Recommended Algorithm workflow
BUILD → commit changes
EXECUTE: roborev review --dirty
→ If PASS: continue to VERIFY
→ If FINDINGS: address in next BUILD iteration
VERIFY: cite roborev exit code 0 as evidence
Installation
macOS / Linux (Homebrew)
brew install roborev-dev/tap/roborev
Go
go install github.com/roborev-dev/roborev@latest
Verify
roborev --version
One-Time Setup
# 1. Install git post-commit hook (auto-reviews on every commit)
roborev init
# 2. Install OpenCode skill (adds roborev commands to agent)
roborev skills install
# 3. Verify config exists at repo root
cat .roborev.toml
Configuration (.roborev.toml)
This repo's config is at .roborev.toml in the root. Key settings:
agent = "opencode"
review_guidelines = """
# PAI-OpenCode Review Guidelines
...
"""
The review_guidelines field gives roborev domain-specific rules for this project —
including the no-console.log constraint, file-logger pattern, and model routing rules.
Troubleshooting
roborev not found
# Install via Homebrew
brew install roborev-dev/tap/roborev
# Or check if it's in PATH
which roborev
echo $PATH
Review times out
Default timeout is 2 minutes. For large changesets, focus the review:
roborev review --dirty -- src/specific/file.ts
No changes found
Make sure you have uncommitted changes:
git diff
git diff --cached # staged changes
Post-commit hook not running
Re-run roborev init to reinstall the hook:
cat .git/hooks/post-commit # verify hook exists
roborev init # reinstall if missing
PAI-OpenCode Specific Guidelines
When running code review on this project, roborev checks for:
- No console.log — all plugin logging via
fileLog()/fileLogError() - Handler pattern — new capabilities = new handler file + import + registration
- No hardcoded models — model routing via
opencode.jsononly - TypeScript strict — no implicit any, explicit return types on exports
- Biome formatting — tabs, 100 char line width, double quotes
Related
.roborev.toml— project review configurationADR-018— architectural decision for roborev integration.opencode/plugins/handlers/roborev-trigger.ts— plugin handler providingcode_reviewtool.github/workflows/code-quality.yml— CI pipeline (Biome check on PRs)
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核